KR100388062B1 - Method of CHAP Authentication for ISP Mobile Subscriber in 3rd Generation GPRS Network - Google Patents

Abstract

The present invention relates to a CHAP (Challenge Handshake Authentication Protocol) authentication method for supporting a mobile service of an ISP (Internet Service Provider) mobile subscriber in a third generation GPRS packet network.

Globally, wired and wireless communication networks are being developed through the development of core mobile communication technology and the establishment of integrated mobile communication network to support mobile communication service anytime and anywhere for all mobile subscribers. In particular, the European-based Global System For Mobile Communications (GSM) network, which occupies more than half of the world's telecommunications market, integrates with Europe's own packet network, GPRS network, to provide mobile subscribers with simultaneous circuit and packet mobile communication services. This is going to build. In addition, in order to support mobile packet service for ISP subscribers, 3G GPRS network supports IP-based ISP mobile subscriber's mobile communication service and PPP (Point to Point) -based ISP mobile subscriber's packet mobile service. In order to achieve this, a GSM-based integrated mobile communication network called UMTS (Universal Mobile Telecommunications System) is being developed. The present invention describes an authentication method required for an ISP network subscriber to receive a mobile packet service through a GPRS network connection. The present invention proposes a packet structure and an authentication protocol required for transmitting an authentication value of an ISP mobile subscriber during CHAP authentication among authentication methods required when an ISP network subscriber attempts to access an ISP network through a GPRS network.

Description

HAP authentication method for 3G GPS subscriber network {Method of CHAP Authentication for ISP Mobile Subscriber in 3rd Generation GPRS Network}

The present invention relates to a connection between a mobile communication network and an internet network (ISP) and an authentication method thereof, and more particularly, to support mobile service of an ISP (Internet Service Provider) mobile subscriber in a third generation GPRS (General Packet Radio Service) packet network. It relates to a CHAP (Challenge Handshake Authentication Protocol) authentication method.

Globally, wired and wireless communication networks are being developed through the development of core mobile communication technology and the establishment of integrated mobile communication network to support mobile communication service anytime and anywhere for all mobile subscribers. In particular, the European-based Global System For Mobile Communications (GSM) network, which occupies more than half of the world's telecommunications market, is integrated with the GPRS network, Europe's own packet network, so that mobile subscribers can simultaneously support circuit and packet mobile communication services. Is being built. In addition, in order to support mobile packet service for ISP subscribers, 3G GPRS network supports the mobile communication service support of IP-based ISP network mobile subscribers and the packet transfer service support of ISP network subscribers based on PPP (Point to Point). In order to make it possible, a GSM-based integrated mobile communication network called UMTS (Universal Mobile Telecommunications System) is being developed.

In addition, the existing wired communication network provided Internet service and packet data service through ISP connection using PPP. Conventionally, a wired ISP subscriber accesses his ISP network within a given limited area through a PPP connection to receive Internet service. At this time, an authentication technology used when establishing an ISP subscriber link is PAP (Password Authentication Protocol) or CHAP (Challenge). However, the PAP and CHAP authentication technologies in PPP allow access to ISP networks within a given limited area based on wired communication networks, and packet mobile network and ISP network authentication can be applied to mobile networks. There is a limit to linkage. Moreover, although the conventional mobile communication network and the ISP network have been developed in such a manner that the PPP server and the NAS are operated on the same platform, the PPP server and the NAS (Network Access Server) are operated on separate platforms, and in this case, PPP and RADIUS There is no solution to the authentication linkage problem with the Remote Access Dial In User Service. The demand for mobile communication is increasing rapidly, and the combination of mobile communication and the Internet is accelerating. In particular, mobile packet data service and Internet service through ISP access of mobile communication network are accelerating. Accordingly, most mobile communication networks are developing mobile communication networks to accommodate PPP technology in a wired network environment for supporting Internet services through connection of mobile communication networks of existing ISP subscribers. That is, subscribers of ISP network should be able to receive internet service and packet data service anytime, anywhere through access of their ISP network even if they are not through home ISP network. At this time, the access network of the ISP network subscriber may be a mobile communication network.

In this case, there are two problems in order for ISP subscriber to receive internet service and packet data service through mobile communication network. Firstly, transferred ISP network subscriber should smoothly access mobile communication network, then mobile communication network, gateway node and ISP network The connection should go smoothly. Accordingly, the ISP subscriber performs the first authentication through the mobile communication network connection at the mobile communication network access terminal, and then performs the second authentication according to his ISP network connection at the mobile communication network gateway node via the access packet mobile communication network. Dynamic IP is assigned or static IP is authenticated. This allows ISP subscribers to receive Internet and packet data services through their mobile network and their ISP network.

However, in reality, the mobile communication network and the ISP network have not been established. Therefore, the mobile communication gateway node and the ISP network interface should be prepared for the processing thereof. Through this, ISP network mobile subscribers can receive the services they want (Internet service, packet data service, line network communication service) through any network anytime and anywhere, and all communication networks are integrated into IP-based network. As the technology is expected to be developed and developed, preparations will be made throughout the communication network. The most prominent field is the combination of packet mobile networks and the Internet.

As a specific example, the ISP network subscriber may be provided with Internet service through a packet mobile communication network connection. However, as pointed out above, ISP access technology using PPP in the existing wired network environment does not provide any type of modification in the terminal (End User) or MT (Mobile Terminal) when the mobile network is connected. There is a problem in linking PPP authentication and RADIUS authentication of the network subscriber.

This is the first authentication based on ISP subscriber's mobile network access through PPP (Point to Point) when establishing link, and second authentication through RADIUS (Remote Access Dial In User Service) when connecting to ISP. Because this is done. Therefore, in this case, if the association between the PPP authentication message and the RADIUS client message is not correctly defined, the ISP subscriber's mobile network connection and authentication will not proceed correctly.

An object of the present invention for solving the problems of the prior art as described above, by clearly presenting the relationship between the PPP CHAP authentication information and the RADIUS client information to be associated with the ISP subscriber's mobile communication network in the transport packet structure, CHAP authentication for ISP mobile subscriber network access in 3rd generation GPRS network to enable subscriber's primary authentication through mobile network connection, secondary authentication through ISP network connection, and primary and secondary authentication connections and Internet service It is to provide a method.

Another object of the present invention is to provide an ISP mobile subscriber with a PPP-based terminal equipment (TE) in a third generation GPRS network that enables a virtual connection of a remote ISP network according to TE movement and a mobile packet data service accordingly. It is to provide a CHAP authentication method when a mobile subscriber accesses a network.

In addition, another object of the present invention is to enable the connection of wired / wireless communication network and packet mobile communication network through all PPP-based TE to enable their ISP network access through their TE anywhere. It is to provide a CHAP authentication method when an ISP mobile subscriber accesses a network in a third generation GPRS network that enables internet service and packet mobile data service.

1 is a structural diagram of a third generation GPRS network to which the present invention is applied.

FIG. 2 is a diagram illustrating a protocol stack of the third generation GPRS network shown in FIG. 1. FIG.

3 is a diagram illustrating a GPRS network access procedure of an ISP mobile subscriber to which the present invention is applied.

4 is a structural diagram of an ISP mobile subscriber authentication message to which the present invention is applied;

5 is a structural diagram of an ISP mobile subscriber enhanced authentication message to which the present invention is applied;

6 is an operational flowchart illustrating an ISP mobile subscriber authentication procedure to which the present invention is applied.

※ Explanation of code about main part of drawing ※

110: GPRS (General Packet Radio Service) network

111: TE (Terminal Equipment)

112: MT (Mobile Terminal)

113: UTRAN (Universal Terminal Radio Access Network)

114: Supporting GPRS Service Node (SGSN)

115: Gateway GPRS Support Node (GGSN)

120: ISP (Internet Service Provider) network

121: RADIUS (Remote Authentication Dial in User Service)

122: Dynamic Host Configuration Protocol (DHCP)

130: Global System For Mobile Communications (GSM) network

131: Mobile Equipment (ME)

132: RAN (Radio Access Network)

133: MSC (Mobile Switch Center) / VLR (Visitor Location Register)

134: Home Location Register (HLR) / Authentication Server (AS)

135: GMSC (Gateway Mobile Switch Center)

140: existing communication network

150: Internet

160: logical matching protocol stack on the control plane between TE / MT GGSN ISP

211-225: GPRS Network Access Procedure of ISP Mobile Subscriber

310: PPP Encapsulation Packet Structure

311: Link Control Protocol (LCP) Packet Structure

312: LCP Configuration Option Packet Structure

313: CHAP Challenge Packet Structure

314: CHAP Response Packet Structure

320: Protocol Configuration Option Structure

330: Generic RADIUS message structure

331: RADIUS access request packet structure

332: RADIUS access request general attribute structure

333: RADIUS access request username attribute structure

334: RADIUS access request user password attribute structure

335: RADIUS access request CHAP password attribute structure

336: RADIUS access request CHAP challenge attribute structure

337: RADIUS Access Accept Packet Structure

In order to achieve the above object, the present invention provides an authentication association between the packet mobile communication network and an Internet service provider (ISP) for a mobile subscriber accessing a packet mobile communication network, whereby the mobile subscriber is connected to a terminal device and a mobile terminal. In the CHAP authentication method for accessing an ISP mobile subscriber's network in a third generation GPRS network, which is connected to an ISP's packet mobile network gateway node (GGSN) and an ISP server to provide Internet service and packet data service, the terminal When the device receives a CHAP challenge message including a CHAP challenge and a CHAP ID from the mobile terminal, the device transmits a CHAP challenge message including a CHAP ID, a CHAP challenge size, a CHAP challenge value, a CHAP password, and user name information to the mobile terminal. Stage 1; After the first step, the mobile terminal sends a protocol configuration option (PCO) message to the GGSN including a CHAP challenge size, a CHAP challenge response size, a CHAP challenge value, and a CHAP challenge packet; A third step of, after performing the second step, the GGSN generates an access request message using a CHAP ID and CHAP challenge information in the PCO message and transmits the access request message to the ISP server; After performing the third step, the ISP server starts the MD5 using the CHAP ID and the CHAP challenge information included in the access request message, compares it with the CHAP password, and returns the result to the GGSN; ; A fifth step of transmitting, by the GGSN, an authentication success message and an IP assigned by the ISP server to the mobile terminal according to the return result after performing the fourth step; And after the fifth step, the mobile terminal transmits the assigned IP to the terminal device, and the terminal device accesses a GPRS network and an ISP network using the assigned IP. It features.

Hereinafter, a CHAP authentication method in connection with an ISP mobile subscriber network in a third generation GPRS network according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The present invention allows an ISP mobile subscriber to access their ISP network through a packet mobile communication network, and solves the connection problem between PPP CHAP authentication and RADIUS authentication in this process. That is, when the ISP mobile subscriber accesses the ISP network through the mobile communication network, the PPP CHAP password must be transmitted to the RADIUS client so that authentication can be performed smoothly with the RADIUS server of the ISP network. Did. However, the European standardization organization for packet data communication only defines roughly that it should connect to ISP network through packet mobile communication network and send protocol message to RADIUS client through PPP in this case.

Accordingly, the present invention proposes two methods as follows. The first approach is for the TE to add a CHAP challenge value within the CHAP Response message. The second approach is to add a CHAP challenge value or CHAP Request message to the RADIUS client in the MT's protocol configuration options message. to be.

The first solution is to add a change function for CHAP response message when TE, which has been connected to ISP through PPP in the existing wired network and receives Internet and packet data service, accesses ISP network through packet mobile communication network. The second scheme is to perform this function in the MT of the packet mobile communication network so that the existing PPP terminal can access the ISP network through the RADIUS client without changing any function for PPP CHAP authentication. Therefore, the ISP network subscriber can access the ISP network through PPP connection anytime, anywhere, through the existing wired communication network or the packet mobile communication network, thereby receiving Internet service and packet data service.

In the present invention, a packet structure necessary for each presentation scheme and an overall operation procedure considering the same are presented.

1 is a diagram illustrating a network configuration in a packet mobile communication network (GPRS) environment to which the present invention is applied, including a general packet radio service (GPRS) 110 and an internet service provider (ISP) network (ISP). 120), GPRS Session Management (GSM) line network 130, the existing communication network 140, and the Internet 150. The packet mobile communication network (GPRS network) 110 includes a terminal equipment (TE) 111, a mobile terminal (MT) 112, a universal terminal radio access network (UTRAN) 113, and a supporting GPRS service node (SGSN) ( 114, and a Gateway GPRS Support Node (GGSN) 115.

In addition, the ISP network 120 includes a Remote Authentication Dial in User Service (RADIUS) 121 and a Dynamic Host Configuration Protocol (DHCP) 122, and the GSM circuitry network 130 is a mobile equipment (ME) 131. Radio Access Network (RAN) 132, Mobile Switch Center (MSC) / Visitor Location Register (VLR) 133, Home Location Register (HLR) / Authentication Server (AS) 134, and Gateway MobileSwitch GMSC. Center 135).

As shown in FIG. 2, the protocol stack for the network component required for accessing the ISP network 120 of the TE 111 in the GPRS network 110 includes a logical matching protocol stack on the control plane between the TE / MT GGSN ISPs. 160). LCP configuration and PPP CHAP authentication are performed between the TE 111 and the MT 112 through a PPP connection, and a protocol configuration option is transmitted between the MT 112 and the GGSN 115 through GTP-C. The GGSN 115 configures RADIUS client information using this information to perform authentication and connection with the RADIUS 121 of the ISP network 120. What is important here is the handling of the PPP CHAP challenge, which enables the association of PPP authentication with RADIUS authentication. Due to the processing of the CHAP challenge, it is possible to establish a RADIUS authentication association with the PPP CHAP. Thus, the ISP TE accesses the ISP network through the GPRS network, thereby receiving the Internet service and the packet data communication service. This is a flowchart illustrating a communication procedure between the TE 111 and the MT 112, the GGSN 115, and the ISP 120 applied in the present invention. First, a link is established through a PPP connection between the TE and the MT, and PPP authentication is performed (211, 212, 213, 214, and 225). Next, a PDP (Packet Data Protocol) session is set up in the GPRS network (215, 216, 223, 224). The GGSN in the GPRS network and the RADIUS and DHCP in the IPS network are connected and authenticated (217, 218, 219, 220, 221, 222).

4 is a structure 310 of a general message transmitted and received during the PPP connection between the TE and the MT. In this figure, 311 is an LCP packet structure transmitted and received in a message, 312 is a structure of an LCP configuration packet, 313 is a CHAP challenge packet structure included in an LCP configuration packet and sent from MT to TE, and 314 is a TE to MT. Outgoing CHAP Response packet structure.

320 is a protocol configuration option (PCO) packet structure sent from MT to GGSN, and 330 is a RADIUS packet structure. 331 is an Access-Request message structure for RADIUS clients prepared in GGSN, 332 is a general attribute structure attached to it, 333 is a User Name Attribute structure, and 334 Is a user password attribute structure, 335 is a CHAP password attribute structure, and 336 is a CHAP challenge attribute structure. Also, 337 is an access-accept message structure responding to a RADIUS server in the ISP.

5 shows two embodiments of a CHAP authentication method for accessing an ISP mobile subscriber network according to the present invention, 410 is an improved CHAP message structure in which a TE adds a CHAP Challenge value in a CHAP response message. 420 is a protocol configuration option message structure of MT to which a CHAP challenge value or CHAP request message is added.

The CHAP message structure 410 defines a CHAP value size field defined within the CHAP challenge, including the CHAP challenge size in the authenticator value (411), and a CHAP challenge after the authenticator value in the value field. Value 412 is added. In addition, a CHAP challenge value size field 413 and a CHAP challenge value field 414 are placed in the CHAP challenge message.

TE and MT modify and process PCO messages sent from MT to GGSN when LCP configuration and PPP CHAP authentication are completed. In this case 420 is a PCO message structure, which adds a CHAP challenge value size or CHAP response size to the protocol ID content length field 421 and adds the CHAP challenge value or CHAP challenge message 422 after the PIDC.

FIG. 6 is an operational flow diagram illustrating an interworking procedure between a TE and an ISP based on the improved CHAP challenge message structure of FIG. 5 and an improved Protocol Configuration Option (PCO) message. FIG. The TE, which has an identity and a user password (secret key) and starts with an initial state 51, obtains a CHAP challenge value and a CHAP ID 511 through a CHAP challenge message received from the MT when the packet is connected to the MT in the MT. Input MD5 (Message Digest 5) 512 to calculate CHAP password. The TE then sends 513 to the MT including the CHAP ID, CHAP challenge value, CHAP password, and username in the CHAP challenge message. After that, TE re-negotiates IPCP negotiation with MT based on whether the authentication from the MT connection from the MT is successful and whether the IP is allocated (514). If the authentication is successful, the TE re-enters the IPCP configuration Ack message received from the MT. Obtain an IP 515 to use. Then, TE can receive internet and packet data communication service through GPRS network and ISP network and then go back to initial state.

The MT, as a PPP server, generates a CHAP challenge and CHAP ID in the initial state 52 through the Srand () function or other random number generation algorithm, or by using the noise received from the MT, and includes it in the CHAP challenge message to be sent to the TE. Send it. Upon receiving the CHAP response message from the TE, the MT configures a protocol configuration option (PCO) message to be sent to the GGSN as shown in FIG. 5 (521) and transmits the message to the GGSN. Afterwards, the MT re-enters IPCP negotiation (522) with the authentication success or the IP assignment based on the ISP connection from the GGSN, and if the authentication is successful, the TE within the PDP generation success message (523) received from the GGSN. Finds the IP to use and includes it in the IPCP configuration Ack message and sends it to TE. The MT then allows the TE to receive Internet and packet data communication services over the GPRS and ISP networks, after which the MT goes back to its initial state.

As a NAS or RADIUS client, the GGSN receives a PDP creation request message including a protocol configuration option (PCO) message from the MT by initializing its registered NAS ID and NAS secret key (53). Herein, a CHADI ID and a CHAP challenge are prepared in a protocol configuration option (PCO) packet included in the received message, and a RADIUS client 531 message is generated based on the CHAP ID. The GGSN then receives an Access-Accept or Access-Reject message based on whether the authentication was successful and the IP assignment according to the ISP connection. When receiving the access rejection message (532), the GGSN sends a PDP creation failure message to the MT, and upon receiving the access acceptance message, the GGSN sends an MD5 (533) as input to the received access message, resulting in authentication to the RADIUS server. If successful (534), the MT sends a PDP creation success message to the MT and an IP assigned by the ISP to be used by the TE. GGSN then enables TE to receive Internet and packet data communication services over GPRS and ISP networks, after which GGSN will be back in its initial state. However, if the result of MD5 on the access message fails (534), the GGSN again generates a RADIUS client message with the CHAP ID and CHAP challenge as input (535) for retransmission to the RADIUS server of the ISP.

The ISP RADIUS server initializes the user password and NAS secret key that the NAS and user share with the RADIUS server when registering the ISP (54), and inputs the CHAP ID and CHAP challenge in the access request message received from GGSN (NAS). Rotate MD5 (541) and compare the CHAP password as a result (542) .If authentication fails, send the access rejection message to GGSN, and if successful, give the TE in the GPRS network to allocate IP (543) and accept the access. Create a message (544) and send it to GGSN. At this time, the response authenticator (Response-Authenticator) to be included in the access acknowledgment message is the result of turning the MD5 by inputting the access acknowledgment message (545), and then the ISP RADIUS server goes back to the initial state.

Next, the ISP network supports TE to receive Internet and packet data communication services through GPRS network and ISP network.

While the invention has been described above based on the preferred embodiments thereof, these embodiments are intended to illustrate rather than limit the invention. It will be apparent to those skilled in the art that various changes, modifications, or adjustments to the above embodiments can be made without departing from the spirit of the invention. Therefore, the protection scope of the present invention will be limited only by the appended claims, and should be construed as including all such changes, modifications or adjustments.

As described above, according to the present invention, it is possible to provide a packet data communication service and an Internet service to an ISP network subscriber in a packet mobile communication network environment by enabling a RADIUS server in an ISP network through a PPP connection of an ISP network mobile subscriber in a packet mobile communication environment. Can be. That is, the ISP network subscribers who are provided with the Internet service through the existing PPP connection receive the same service through the PPP connection even in the mobile communication network environment, and further support the roaming service function to the ISP network subscribers. In addition, it solves PPP CHAP authentication access of ISP subscriber and RADIUS authentication access in ISP network through packet mobile communication network.

More specifically, the present invention has the following effects. First, it is possible to solve the mutual authentication association problem due to PPP CHAP connection and RADIUS connection. Second, the PPP CHAP challenge on the TE and MT side can solve the PPP connection. Thirdly, it enables the ISP network subscriber through the existing PPP connection to access the ISP network through the packet mobile communication network, thereby receiving Internet service and packet data service. Fourthly, it enables subscribers of ISP network through existing PPP connection to access their own ISP network through GPRS network, which is a European packet mobile communication network. Fifth, this ultimately enables the interworking of packet mobile communication network and ISP network and roaming service support of ISP network subscriber.

Claims (10)

delete delete delete delete delete By providing authentication association between the packet mobile communication network and the Internet service provider (ISP) for mobile subscribers accessing through a packet mobile communication network, the mobile subscriber is a packet mobile communication network gateway node (GGSN) of a terminal device, a mobile terminal and an ISP. In the CHAP authentication method for accessing ISP mobile subscriber network in 3rd generation GPRS network, which is provided with Internet service and packet data service by connecting to ISP and ISP server, When the terminal device receives a CHAP challenge message including a CHAP challenge and a CHAP ID from the mobile terminal, a CHAP challenge message including a CHAP ID, a CHAP challenge size, a CHAP challenge value, a CHAP password, and a user name information is transmitted to the mobile terminal. A first step of making; After the first step, the mobile terminal sends a protocol configuration option (PCO) message to the GGSN including a CHAP challenge size, a CHAP challenge response size, a CHAP challenge value, and a CHAP challenge packet; A third step of, after performing the second step, the GGSN generates an access request message using a CHAP ID and CHAP challenge information in the PCO message and transmits the access request message to the ISP server; After performing the third step, the ISP server, using the CHAP ID and CHAP challenge information included in the access request message to run MD5, compare with the CHAP password, and return the result to the GGSN fourth step; A fifth step of transmitting, by the GGSN, an authentication success message and an IP assigned by the ISP server to the mobile terminal according to the return result after performing the fourth step; And And after the fifth step, the mobile terminal transmits the assigned IP to the terminal device, and the terminal device accesses a GPRS network and an ISP network using the assigned IP. CHAP authentication method for ISP mobile subscriber network access in 3G GPRS network. delete The method of claim 6, The fifth step, When the GGSN receives an access rejection message from the ISP server, transmitting an authentication failure message to the mobile terminal; When the access acknowledgment message is received from the ISP server, starting MD5 using the received access acknowledgment message; And If the authentication is successful as a result of the calculation of MD5, CHAP when the ISP mobile subscriber accesses the network in the 3rd generation GPRS network, comprising the step of transmitting an authentication success message to the mobile terminal and the IP assigned by the ISP server. Authentication method. The method of claim 8, If authentication fails according to the MD5 calculation result, generating a RADIUS client message by inputting a CHAP ID and a CHAP challenge, and retransmitting to the ISP server. CHAP authentication method when accessing network. delete